Schneier on Security

Clive Robinson • August 15, 2023 5:36 PM

@ AC, ALL,

“This continues to show that when entities use the term “End to End Encryption”, they typically fail to mention that they consider themselves “one of the legitimate ends” without telling you about that.”

The problem is technically and mathematically they kind of have to be “one of the legitimate ends”.

The fact that most don’t realise it will mean we will see the problem over and over again superficially different, but fundamentally the same. And each time people will be “hurt” in that “their privacy will be invaded”.

I’ve mentioned it before back towards the begining on the up-tick on the usage of Zoom and Meetings.

When people sit around a table to talk they “broadcast” to all” at the table. But they do not think about it in terms of individual communications paths.

When two people converse two “Shannon Channels” AB and BA are required.

When three people converse six “Shannon Channels” AB, AC, BA, BC, CA and CB are required.

When four people converse twelve “Shannon Channels” are required.

And so on, for N participants you end up needing (N^2 – N) channels.

In effect the total bandwidth rises by N^2 so with a dozen people as all to often happens with certain types of “meetings” you would need 144-12 or 132 Shannon Channels.

This is not managable and most of the time only one channel or two is in use at any one moment.

Thus technically a simple solution where bandwidth only goes up as a simple function of N is to form a central switching point or “star system”.

You have N channels going into the hub and N channels going out. However the outbound channels are effectively all the same being the summation of the N input channels of only which one or two are active at any point.

The key to this solution is,

“The summing of signals at the hub”

It works fine with unencrypted signals but with the likes of “Block Encryption” can not be done[1]. So to alow an N party system to work with only 2N channels of bandwidth carrying N+1 sets of information the summation has to be done in “plaintext” thus those N input channels have to be decrypted at the central hub before they are summed, then the output from the summer re-encrypted before being sebt out of the N output channels.

Worse unless further encryption is used on each output channel they “stand in witness” to who the communicating N parties are simply because they will be by easy inspection the same. Thus act as a “distinguisher” via observable meta-data so almost instant…

If people do not know this effects all “shared channel” systems including the likes of “group texts/messaging” then they will provide easy meta-data to an attacker. Which is what “Traffic Analysis” is all about at the end of the day, and in many ways is considered more important than conventional cryptanalysis…

[1] In theory with stream encryption providing everything is sychronized you can “sum the key streams” as well as “sum the ciphertext streams” and subtract one from the other. But the synchronisation is a nightmare so somebody always ends up using a single key stream for multiple plaintext streams. This is a major “NO NO” as it instantly fails to a “message in depth” attack that is at heart a “Key Reuse Attack”. A similar issue arises with the current asynchronous ciphers.

Clive Robinson • August 16, 2023 7:53 AM

@ NobodySpecial, ALL,

Re : Ask not which way the wid blows, but from whence it comes.

“Didn’t Zoom change course last Friday? Remarkably fast for such a large corporation tabout face. Must have had some “interesting” board meetings…”

The change of tack may not have anything to do with “corporate” intentions but what is happening in the technological playing field.

That is the Corporation has a destination in mind, and they realy don’t care about the journey as long as it’s fast and efficient.

A few months back investors and others appeared to be going nuts over LLM AI as being the “next sure thing” throwing cash at it like it was confetti. Now however a lot of truth, facts and figures about LLM’s and AI in general has come much more publically into play.

Less obvious is the crypto-cash backlash, with lots of suppused Billionaire’s in home arrest or heading to jail and long court cases. With investors asking the question “where’s my money” to find the piggybank is not just empty it was never realy there, as Peter payed Paul but the bank claimed the credit to Paul but not the debit from Peter, thus double booked etc[1].

What dawned on people were the stories of Nvidia becoming the first trillion dollar chip company. They started not just listening but paying attention when told those GPU prices were from people running,

1, Crypto-cash mining rigs.
2, LLM model builders.

And realising in both cases a lot of dollars were going to Nvidia and also to burning fosil fuels and other non replacable resources in vastly increasing quantaties. But the only output was a bunch of numbers or bits on a hard drive that could not answer the “Show me the money?” question.

Worse two other things,

1, Those numbers have no legal protection as they are not property so have no actual value.
2, All of a sudden those playing with the first generation of numbers were heading for what might as well be infinite punishment.

So almost over night people started to realise that this LLM AI was in all probability just another very high risk speculation with all the investment scooting out the back door to “suppliers” but the only real money coming in was only from “investors” with potentially big jail terms and massive fines a short journy down the road. Thus stopping any potential return quicker and deader than the Lyall’s wren to just one “fat cat”[2].

So the corporate board probably decided “Shareholder Value” was not going to get increased by LLM AI any time soon… however the risk to their bonuses by adverse AI publicity was potentiall very immediate.

I’ve previously pointed out three things about LLM AI that will be interesting to watch,

1, If you are going to invest don’t invest in LLM companies but the companies that LLM depends on like Nvidia.
2, The only return from LLM AI curently is by enhancing “Surveillance Capitalism” as evidenced by the Silicon Valley Corps driving it forward.
3, Venture Capitalists having lost Web3 and NFTs / Smart Contracts to creat a highly profitable for them bubble faux-market were starting to pump LLMs to replace it.

The first has sofar been correct if you look at Nvida share performance V Meta/Facebook etc. However unless Nvidia can find a new premium market for their GPU’s or an alternative…

The second is still true, though there does appear to be some LLM value in models with tightly curated input that is both factual and not variant (think the harder ends of science).

The third is kind of what this thread and my post is all about. Because it looks like either the bubble has not got going or has halted. Either way caution appears to be the investment direction currently so wild / rampant speculation has not yet happened and by the looks of it may not.

Let’s come back in a year or two to see which way fortunes winds have blown from 😉

And before anyone asks, no I’ve no skin in this game, other than the price of the popcorn in my kitchen cupboard.

[1] There is a semi legitimate form of this trick which is “churn” where you say each dollar in circulation causes say ten times the economic activity. Unfortunately it can be easily misunderstood with some thinking there must be ten dollars to spend on consumables etc that show no return after purchase.

[2] The story of the Lyall’s wren is about ecological disaster and species extinction in as little as a year due to a pregnant cat and her offspring. For several species that fat cat was the start of an existential pandemic. As a side note, Lyall was an amateur naturalist and recognised the wren as a new species, so claimed the naming rights. However the process short as it was resulted in Lyall’s claim on naming the wren beong accepted and notified to him after the wren was extinct.

If you happen to go to New Zeland and encounter the inbound restrictions on biologicals as I once did, just think of Lyall’s wren. My encounter was to travel to NZ wearing a pair of mud encrusted walking boots that had got that way during the journey. On seeing them i was ordered to remove them and they were taken away and I had to sit there answering numerous officials questions. My boots were returned to me sparklingly clean with new laces, and my ears were ringing with the stern warnings about not doing it again as NZ took protecting it’s native wild life seriously…